RE: One question about trusted key of keyring in Linux kernel.

[Zhao, Shirley]

Hi, James, 

The value of PCR7 is not changed. I have checked it with TPM command tpm_pcrlist. 

So I think the problem is how to use the option policydigest and policyhandle? Is there any example?
Maybe the format in my command is not correct. 

Thanks. 

- Shirley 

-----Original Message-----
From: James Bottomley <jejb@xxxxxxxxxxxxx> 
Sent: Saturday, November 30, 2019 4:05 AM
To: Zhao, Shirley <shirley.zhao@xxxxxxxxx>; Mimi Zohar <zohar@xxxxxxxxxxxxx>; Jarkko Sakkinen <jarkko.sakkinen@xxxxxxxxxxxxxxx>; Jonathan Corbet <corbet@xxxxxxx>
Cc: linux-integrity@xxxxxxxxxxxxxxx; keyrings@xxxxxxxxxxxxxxx; linux-doc@xxxxxxxxxxxxxxx; linux-kernel@xxxxxxxxxxxxxxx; 'Mauro Carvalho Chehab' <mchehab+samsung@xxxxxxxxxx>; Zhu, Bing <bing.zhu@xxxxxxxxx>; Chen, Luhai <luhai.chen@xxxxxxxxx>
Subject: Re: One question about trusted key of keyring in Linux kernel.

On Fri, 2019-11-29 at 01:40 +0000, Zhao, Shirley wrote:
> Hi, James,
> 
> Maybe the TPM command confused you. 

Well you did seem to be saying we had a problem in the TPM sealed key subsystem.

> The question is I use keyctl command sealed a trusted key with PCR 
> policy, but load it failed after reboot.
> I don't know why it was loaded failed. I use TPM command to help find 
> it, it report policy check failed.

Right, so your question seems to be why after a reboot, the TPM policy no longer works to authorize the key even from user space?  My best guess would be the PCR value you've sealed it to changed over the reboot for some reason.

> So my question is how to load the PCR policy sealed trusted key 
> correctly?

You have to set the sealing release policy to something you know will be invariant across reboots for an unseal to happen reliably.  However, usually you also want the unseal to fail if something you don't like changes, so you set the policy to be something that's invariant unless that happens.  Not really knowing what your conditions are we can't really tell you what your policy should look like.

> How to use policydigest and policyhandle correctly. 

I've no real idea how the tpm2_ commands work, but the tsspolicy commands all have man pages which do a pretty good explanation.  If I infer how your tpm2_ commands seem to be working, I think you're sealing to a pcr7 hash?  pcr7 is the one that's supposed to measure the secure boot path and properties and as such shouldn't change across reboots, so I think your problem becomes finding out why it changed.

James